validate all input

[derrell]

We currently have input coming from the user (in an RPC) that is entirely unvalidated and put into the database. In some cases, the data needs conversion (e.g. tags may be converted from a series of comma-separated values into an array), and in other cases, the the type is unverified, and user-supplied invalid data can end up getting saved.